CVE-2026-35309 is a critical security vulnerability in Oracle Coherence, a component of Oracle Fusion Middleware's Centralized Third Party Jars. It affects versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Coherence, potentially leading to full system takeover. The CVSS 3.1 score is 9.8 with attack vector network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's June 2026 Critical Security Patch Update advisory references this vulnerability among 245 security patches but does not explicitly state a dedicated patch for this CVE. Oracle recommends applying the Critical Security Patch Update immediately and suggests network-level mitigations such as blocking attack vectors and restricting privileges to reduce risk until patches are applied.

Successful exploitation of CVE-2026-35309 can lead to complete compromise of Oracle Coherence, impacting confidentiality, integrity, and availability of the affected system. An unauthenticated attacker with network access via HTTP can take over the system, which may allow unauthorized data access, modification, or denial of service. The vulnerability is rated critical with a CVSS 3.1 base score of 9.8, reflecting the severity of potential impacts.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to address this vulnerability. Although the advisory does not explicitly confirm a dedicated patch for CVE-2026-35309, the update includes 245 security patches covering multiple products including Oracle Coherence. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation (e.g., HTTP access to Oracle Coherence) and by removing unnecessary privileges or access to vulnerable components from users who do not require them. These mitigations may affect application functionality and should be tested accordingly. Customers should monitor Oracle's advisory page for updates and patch availability confirmation.